# Audit-loop implementation — smoke mock false positive
Base/Reviewed SHA: 17faecd962c2cf40e0a3f6ec4434811cfffdd312
HEAD at report generation: 17faecd962c2cf40e0a3f6ec4434811cfffdd312; follow-up changes uncommitted pending shared fix commit.

Independent auditor1 MEDIUM is addressed by production factory refusal of explicit VK mocks, Compose USE_VK_MOCK=false, and server-generated actual providerMode in preview/import summary. Smoke requires LIVE mode and a nonempty import for G/H; zero participants cannot prove subscription API execution. All prior existing tests remain untouched; new tests exercise mock-preview labeling, production refusal, live-instance labeling, actual Bash smoke against MOCK/LIVE/zero-count HTTP fixtures and secret-marker suppression.

Changed files: src/providers/factory.ts; src/app/api/posts/preview/route.ts; src/app/api/giveaways/[id]/participants/route.ts; compose.production.yml; tools/vk-smoke.sh; docs/VK_REAL_SMOKE_TEST.md; docs/PRODUCTION_GUARDS.md; tests/vk-smoke-provider-mode.test.ts; this inbox/result.

Commands actually run:
- npx vitest run tests/vk-smoke-provider-mode.test.ts: exit0, 6 tests passed (including actual shell subprocess regressions).
- bash -n tools/vk-smoke.sh: exit0.
- git diff --check: exit0.

Full gate and independent rereview pending at fix SHA. No real VK credentials, no live VK evidence. Finding remains open until independent rereview. Other reviewer HIGH malformed-items fix is separate provider/test work by coder1, to be included in same fix commit. Pre-existing COMMUNITY admin metadata LOW remains nonblocking debt; server static capability guard rejects unsupported manager exclusion.